@team-semicolon/semicolony-cli 4.18.51 → 4.18.53

package/migrations/149_hive_cron_capability_templates.sql

@@ -0,0 +1,44 @@
+-- 149_hive_cron_capability_templates.sql
+-- SEMO Ops Hive cron parity: reviewed, non-executable capability templates.
+--
+-- This table stores policy template metadata only. It does not enqueue, grant, enable,
+-- execute, or retire any cron job. The migration runner wraps this file in one
+-- transaction, so do not add BEGIN/COMMIT here.
+
+CREATE TABLE IF NOT EXISTS semicolony.cron_capability_templates (
+  bot_id                  TEXT NOT NULL,
+  job_id                  TEXT NOT NULL,
+  runtime_source          TEXT NOT NULL,
+  permission              TEXT NOT NULL CHECK (permission IN ('read', 'make', 'operate')),
+  resource_scopes         TEXT[] NOT NULL CHECK (cardinality(resource_scopes) > 0),
+  destination             TEXT NOT NULL,
+  timeout_seconds         INTEGER NOT NULL CHECK (timeout_seconds > 0 AND timeout_seconds <= 3600),
+  idempotency_key_template TEXT NOT NULL,
+  expected_outcome_digest TEXT NOT NULL CHECK (expected_outcome_digest ~ '^sha256:[a-f0-9]{64}$'),
+  source_hash             TEXT NOT NULL CHECK (source_hash ~ '^sha256:[a-f0-9]{64}$'),
+  legacy_profile          TEXT NOT NULL,
+  legacy_job_id           TEXT NOT NULL,
+  created_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (bot_id, job_id, runtime_source),
+  CHECK (bot_id = 'semi'),
+  CHECK (runtime_source = 'hive-cron-v2'),
+  CHECK (legacy_job_id = job_id),
+  CHECK (idempotency_key_template = 'cron:' || job_id || ':{scheduled_for}'),
+  CHECK (NOT ('*' = ANY(resource_scopes))),
+  CHECK (array_position(resource_scopes, NULL) IS NULL),
+  FOREIGN KEY (bot_id, job_id)
+    REFERENCES semicolony.bot_cron_jobs(bot_id, job_id)
+);
+
+COMMENT ON TABLE semicolony.cron_capability_templates IS
+  'Non-executable reviewed capability templates for disabled Hive cron parity imports.';
+
+COMMENT ON COLUMN semicolony.cron_capability_templates.permission IS
+  'Reviewed maximum permission for a scheduled occurrence lease: read | make | operate.';
+
+COMMENT ON COLUMN semicolony.cron_capability_templates.resource_scopes IS
+  'Explicit resource scopes used to mint a future per-occurrence lease. No wildcard scopes.';
+
+CREATE INDEX IF NOT EXISTS idx_cron_capability_templates_legacy_job
+  ON semicolony.cron_capability_templates(legacy_profile, legacy_job_id);

package/migrations/150_hive_cron_action_contract.sql

@@ -0,0 +1,38 @@
+-- 150_hive_cron_action_contract.sql
+-- Adds a fail-closed typed action binding to reviewed Hive cron templates.
+-- Existing templates remain unregistered because all three columns are nullable.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+ALTER TABLE semicolony.cron_capability_templates
+  ADD COLUMN IF NOT EXISTS action_kind TEXT,
+  ADD COLUMN IF NOT EXISTS action_version INTEGER,
+  ADD COLUMN IF NOT EXISTS action_contract_digest TEXT;
+
+ALTER TABLE semicolony.cron_capability_templates
+  DROP CONSTRAINT IF EXISTS cron_capability_templates_action_contract_check;
+
+ALTER TABLE semicolony.cron_capability_templates
+  ADD CONSTRAINT cron_capability_templates_action_contract_check CHECK (
+    (
+      action_kind IS NULL
+      AND action_version IS NULL
+      AND action_contract_digest IS NULL
+    )
+    OR
+    (
+      action_kind IS NOT NULL
+      AND action_version IS NOT NULL
+      AND action_contract_digest IS NOT NULL
+      AND action_version > 0
+      AND action_contract_digest ~ '^[a-f0-9]{64}$'
+    )
+  );
+
+COMMENT ON COLUMN semicolony.cron_capability_templates.action_kind IS
+  'Registered typed action kind; NULL means the capability template is not executable.';
+
+COMMENT ON COLUMN semicolony.cron_capability_templates.action_version IS
+  'Positive typed action contract version; NULL means unregistered.';
+
+COMMENT ON COLUMN semicolony.cron_capability_templates.action_contract_digest IS
+  'Raw lowercase SHA-256 digest of ActionContractCanonicalV1; excludes Legacy SEMO source_hash provenance.';

package/migrations/151_hive_cron_occurrence_leases.sql

@@ -0,0 +1,150 @@
+-- @schema-retarget: off
+-- 151_hive_cron_occurrence_leases.sql
+-- Durable ownership for Hive cron typed read-action occurrences.
+-- The migration runner supplies the transaction boundary; do not add BEGIN/COMMIT.
+
+CREATE TABLE IF NOT EXISTS semicolony.cron_read_action_occurrence_leases (
+  idempotency_key TEXT PRIMARY KEY
+    CHECK (idempotency_key ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$'),
+  claim_id TEXT NOT NULL UNIQUE
+    CHECK (claim_id ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'),
+  state TEXT NOT NULL DEFAULT 'acquired'
+    CHECK (state IN ('acquired', 'completed', 'released_failed')),
+  acquired_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ,
+  CHECK (
+    (state = 'acquired' AND completed_at IS NULL)
+    OR (state IN ('completed', 'released_failed') AND completed_at IS NOT NULL)
+  )
+);
+
+COMMENT ON TABLE semicolony.cron_read_action_occurrence_leases IS
+  'Durable occurrence ownership and terminal tombstones for Hive cron typed read actions.';
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_protect_terminal_lease()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+BEGIN
+  IF OLD.state IN ('completed', 'released_failed') THEN
+    RAISE EXCEPTION 'terminal occurrence lease is immutable'
+      USING ERRCODE = '23514';
+  END IF;
+  IF TG_OP = 'DELETE' THEN
+    RETURN OLD;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS hive_cron_terminal_lease_guard
+  ON semicolony.cron_read_action_occurrence_leases;
+CREATE TRIGGER hive_cron_terminal_lease_guard
+  BEFORE UPDATE OR DELETE ON semicolony.cron_read_action_occurrence_leases
+  FOR EACH ROW
+  EXECUTE FUNCTION semicolony.hive_cron_protect_terminal_lease();
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_acquire_lease(
+  p_job_id text,
+  p_idempotency_key text,
+  p_claim_id text
+)
+RETURNS TABLE (outcome text)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  inserted_count integer;
+  key_prefix text := 'cron:' || p_job_id || ':';
+BEGIN
+  IF p_job_id IS NULL
+     OR p_idempotency_key IS NULL
+     OR p_claim_id IS NULL
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length(key_prefix) + 24
+     OR pg_catalog.left(p_idempotency_key, pg_catalog.char_length(key_prefix))
+          IS DISTINCT FROM key_prefix
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR NOT EXISTS (
+       SELECT 1
+       FROM semicolony.cron_capability_templates AS template
+       WHERE template.bot_id = 'semi'
+         AND template.job_id = p_job_id
+         AND template.runtime_source = 'hive-cron-v2'
+         AND template.action_kind IS NOT NULL
+         AND template.action_version IS NOT NULL
+         AND template.action_contract_digest IS NOT NULL
+     ) THEN
+    RETURN;
+  END IF;
+
+  INSERT INTO semicolony.cron_read_action_occurrence_leases (
+    idempotency_key,
+    claim_id
+  )
+  VALUES (p_idempotency_key, p_claim_id)
+  ON CONFLICT (idempotency_key) DO NOTHING;
+  GET DIAGNOSTICS inserted_count = ROW_COUNT;
+
+  RETURN QUERY
+  SELECT CASE WHEN inserted_count = 1 THEN 'acquired'::text ELSE 'duplicate'::text END;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_release_failed(
+  p_job_id text,
+  p_idempotency_key text,
+  p_claim_id text
+)
+RETURNS TABLE (outcome text)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  released_count integer;
+  key_prefix text := 'cron:' || p_job_id || ':';
+BEGIN
+  IF p_job_id IS NULL
+     OR p_idempotency_key IS NULL
+     OR p_claim_id IS NULL
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length(key_prefix) + 24
+     OR pg_catalog.left(p_idempotency_key, pg_catalog.char_length(key_prefix))
+          IS DISTINCT FROM key_prefix
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR NOT EXISTS (
+       SELECT 1
+       FROM semicolony.cron_capability_templates AS template
+       WHERE template.bot_id = 'semi'
+         AND template.job_id = p_job_id
+         AND template.runtime_source = 'hive-cron-v2'
+         AND template.action_kind IS NOT NULL
+         AND template.action_version IS NOT NULL
+         AND template.action_contract_digest IS NOT NULL
+     ) THEN
+    RETURN;
+  END IF;
+
+  UPDATE semicolony.cron_read_action_occurrence_leases
+  SET state = 'released_failed',
+      completed_at = pg_catalog.clock_timestamp()
+  WHERE idempotency_key = p_idempotency_key
+    AND claim_id = p_claim_id
+    AND state = 'acquired';
+  GET DIAGNOSTICS released_count = ROW_COUNT;
+
+  IF released_count = 1 THEN
+    RETURN QUERY SELECT 'released_failed'::text;
+  END IF;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_protect_terminal_lease() FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_acquire_lease(text, text, text) FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_release_failed(text, text, text) FROM PUBLIC, sc_app;

package/migrations/152_hive_cron_relay_outbox.sql

@@ -0,0 +1,243 @@
+-- @schema-retarget: off
+-- 152_hive_cron_relay_outbox.sql
+-- Digest-only persistent relay reservation and terminal tombstones.
+-- The migration runner supplies the transaction boundary; do not add BEGIN/COMMIT.
+
+CREATE TABLE IF NOT EXISTS semicolony.cron_read_action_relay_outbox (
+  idempotency_key TEXT PRIMARY KEY
+    CHECK (idempotency_key ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$'),
+  request_digest TEXT NOT NULL
+    CHECK (request_digest ~ '^[a-f0-9]{64}$'),
+  state TEXT NOT NULL DEFAULT 'pending'
+    CHECK (state IN ('pending', 'completed')),
+  outcome_status TEXT
+    CHECK (outcome_status IN ('delivered', 'suppressed', 'failed')),
+  error_code TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ,
+  CHECK (
+    (state = 'pending' AND outcome_status IS NULL AND error_code IS NULL AND completed_at IS NULL)
+    OR
+    (state = 'completed' AND outcome_status IN ('delivered', 'suppressed')
+      AND error_code IS NULL AND completed_at IS NOT NULL)
+    OR
+    (state = 'completed' AND outcome_status = 'failed'
+      AND error_code = 'delivery_failed' AND completed_at IS NOT NULL)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_cron_read_action_relay_outbox_pending_age
+  ON semicolony.cron_read_action_relay_outbox (created_at)
+  WHERE state = 'pending';
+
+COMMENT ON TABLE semicolony.cron_read_action_relay_outbox IS
+  'Digest-only relay reservation and terminal outcomes for Hive cron typed read actions.';
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_protect_terminal_outbox()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+BEGIN
+  IF OLD.state = 'completed' THEN
+    RAISE EXCEPTION 'terminal relay outbox row is immutable'
+      USING ERRCODE = '23514';
+  END IF;
+  IF TG_OP = 'DELETE' THEN
+    RETURN OLD;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS hive_cron_terminal_outbox_guard
+  ON semicolony.cron_read_action_relay_outbox;
+CREATE TRIGGER hive_cron_terminal_outbox_guard
+  BEFORE UPDATE OR DELETE ON semicolony.cron_read_action_relay_outbox
+  FOR EACH ROW
+  EXECUTE FUNCTION semicolony.hive_cron_protect_terminal_outbox();
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_put_outbox(
+  p_job_id text,
+  p_idempotency_key text,
+  p_request_digest text
+)
+RETURNS TABLE (mutation_status text)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  inserted_count integer;
+  key_prefix text := 'cron:' || p_job_id || ':';
+BEGIN
+  IF p_job_id IS NULL
+     OR p_idempotency_key IS NULL
+     OR p_request_digest !~ '^[a-f0-9]{64}$'
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length(key_prefix) + 24
+     OR pg_catalog.left(p_idempotency_key, pg_catalog.char_length(key_prefix))
+          IS DISTINCT FROM key_prefix
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR NOT EXISTS (
+       SELECT 1
+       FROM semicolony.cron_capability_templates AS template
+       WHERE template.bot_id = 'semi'
+         AND template.job_id = p_job_id
+         AND template.runtime_source = 'hive-cron-v2'
+         AND template.action_kind IS NOT NULL
+         AND template.action_version IS NOT NULL
+         AND template.action_contract_digest IS NOT NULL
+     ) THEN
+    RETURN;
+  END IF;
+
+  INSERT INTO semicolony.cron_read_action_relay_outbox AS outbox (
+    idempotency_key,
+    request_digest
+  )
+  VALUES (p_idempotency_key, p_request_digest)
+  ON CONFLICT (idempotency_key) DO NOTHING
+  ;
+  GET DIAGNOSTICS inserted_count = ROW_COUNT;
+
+  RETURN QUERY
+  SELECT CASE WHEN inserted_count = 1 THEN 'inserted'::text ELSE 'existing'::text END;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_get_outbox(
+  p_job_id text,
+  p_idempotency_key text,
+  p_request_digest text
+)
+RETURNS TABLE (
+  lookup_status text,
+  outcome_status text,
+  error_code text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  stored_digest text;
+  stored_state text;
+  stored_outcome text;
+  stored_error text;
+  key_prefix text := 'cron:' || p_job_id || ':';
+BEGIN
+  IF p_job_id IS NULL
+     OR p_idempotency_key IS NULL
+     OR p_request_digest !~ '^[a-f0-9]{64}$'
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length(key_prefix) + 24
+     OR pg_catalog.left(p_idempotency_key, pg_catalog.char_length(key_prefix))
+          IS DISTINCT FROM key_prefix
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR NOT EXISTS (
+       SELECT 1
+       FROM semicolony.cron_capability_templates AS template
+       WHERE template.bot_id = 'semi'
+         AND template.job_id = p_job_id
+         AND template.runtime_source = 'hive-cron-v2'
+         AND template.action_kind IS NOT NULL
+         AND template.action_version IS NOT NULL
+         AND template.action_contract_digest IS NOT NULL
+     ) THEN
+    RETURN;
+  END IF;
+
+  SELECT outbox.request_digest,
+         outbox.state,
+         outbox.outcome_status,
+         outbox.error_code
+  INTO stored_digest, stored_state, stored_outcome, stored_error
+  FROM semicolony.cron_read_action_relay_outbox AS outbox
+  WHERE outbox.idempotency_key = p_idempotency_key;
+
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT 'missing'::text, NULL::text, NULL::text;
+  ELSIF stored_digest <> p_request_digest THEN
+    RETURN QUERY SELECT 'digest_mismatch'::text, NULL::text, NULL::text;
+  ELSIF stored_state = 'pending' THEN
+    RETURN QUERY SELECT 'pending'::text, NULL::text, NULL::text;
+  ELSE
+    RETURN QUERY SELECT 'completed'::text, stored_outcome, stored_error;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_complete_outbox(
+  p_job_id text,
+  p_idempotency_key text,
+  p_request_digest text,
+  p_outcome_status text,
+  p_error_code text
+)
+RETURNS TABLE (
+  mutation_status text,
+  outcome_status text,
+  error_code text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  completed_count integer;
+  key_prefix text := 'cron:' || p_job_id || ':';
+BEGIN
+  IF p_job_id IS NULL
+     OR p_idempotency_key IS NULL
+     OR p_request_digest !~ '^[a-f0-9]{64}$'
+     OR pg_catalog.char_length(p_idempotency_key)
+          IS DISTINCT FROM pg_catalog.char_length(key_prefix) + 24
+     OR pg_catalog.left(p_idempotency_key, pg_catalog.char_length(key_prefix))
+          IS DISTINCT FROM key_prefix
+     OR pg_catalog.right(p_idempotency_key, 24)
+          !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$'
+     OR NOT (
+       (p_outcome_status IN ('delivered', 'suppressed') AND p_error_code IS NULL)
+       OR (p_outcome_status = 'failed' AND p_error_code = 'delivery_failed')
+     )
+     OR NOT EXISTS (
+       SELECT 1
+       FROM semicolony.cron_capability_templates AS template
+       WHERE template.bot_id = 'semi'
+         AND template.job_id = p_job_id
+         AND template.runtime_source = 'hive-cron-v2'
+         AND template.action_kind IS NOT NULL
+         AND template.action_version IS NOT NULL
+         AND template.action_contract_digest IS NOT NULL
+     ) THEN
+    RETURN;
+  END IF;
+
+  UPDATE semicolony.cron_read_action_relay_outbox AS outbox
+  SET state = 'completed',
+      outcome_status = p_outcome_status,
+      error_code = p_error_code,
+      completed_at = pg_catalog.clock_timestamp()
+  WHERE outbox.idempotency_key = p_idempotency_key
+    AND outbox.request_digest = p_request_digest
+    AND outbox.state = 'pending'
+  ;
+  GET DIAGNOSTICS completed_count = ROW_COUNT;
+
+  IF completed_count = 1 THEN
+    RETURN QUERY SELECT 'completed'::text, p_outcome_status, p_error_code;
+  ELSE
+    RETURN QUERY SELECT 'not_completed'::text, NULL::text, NULL::text;
+  END IF;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_protect_terminal_outbox() FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_put_outbox(text, text, text) FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_get_outbox(text, text, text) FROM PUBLIC, sc_app;
+REVOKE ALL ON FUNCTION semicolony.hive_cron_complete_outbox(text, text, text, text, text)
+  FROM PUBLIC, sc_app;

package/migrations/153_hive_cron_evidence_uniqueness.sql

@@ -0,0 +1,9 @@
+-- Hive cron v2 retirement evidence must be unique across arbitrary commitment IDs.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_hive_cron_evidence_idempotency
+  ON semicolony.bot_commitments ((metadata->>'idempotency_key'))
+  WHERE bot_id = 'semi'
+    AND source_type = 'cron'
+    AND runtime_source = 'hive-cron-v2'
+    AND metadata->>'cron_parity_runtime' = 'hive-cron-v2';